5 Commits

Include renames

Author	SHA1	Message	Date
clawbotandclawbot	08f57bc105	feat: add per-IP rate limiting to login endpoint (#78) ... ## Summary Adds per-IP rate limiting to `POST /api/v1/login` to prevent brute-force password attacks. closes #35 ## What Changed ### New package: `internal/ratelimit/` A generic per-key token-bucket rate limiter built on `golang.org/x/time/rate`: - `New(ratePerSec, burst)` creates a limiter with automatic background cleanup of stale entries - `Allow(key)` checks if a request from the given key should be permitted - `Stop()` terminates the background sweep goroutine - Stale entries (unused for 15 minutes) are pruned every 10 minutes ### Login handler integration The login handler (`internal/handlers/auth.go`) now: 1. Extracts the client IP from `X-Forwarded-For`, `X-Real-IP`, or `RemoteAddr` 2. Checks the per-IP rate limiter before processing the login 3. Returns **429 Too Many Requests** with a `Retry-After: 1` header when the limit is exceeded ### Configuration Two new environment variables (via Viper): | Variable | Default | Description | |---|---|---| | `LOGIN_RATE_LIMIT` | `1` | Allowed login attempts per second per IP | | `LOGIN_RATE_BURST` | `5` | Maximum burst of login attempts per IP | ### Scope Per [sneak's instruction](sneak/chat#35), only the login endpoint is rate-limited. Session creation and registration use hashcash proof-of-work instead. ## Tests - 6 unit tests for the `ratelimit` package (constructor, burst, burst exceeded, key isolation, key tracking, stop) - 2 integration tests in `api_test.go`: - `TestLoginRateLimitExceeded`: exhausts burst with rapid requests, verifies 429 response and `Retry-After` header - `TestLoginRateLimitAllowsNormalUse`: verifies normal login still works ## README - Added "Login Rate Limiting" subsection under "Rate Limiting & Abuse Prevention" - Added `LOGIN_RATE_LIMIT` and `LOGIN_RATE_BURST` to the Configuration table Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de> Reviewed-on: sneak/chat#78 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-22 00:39:38 +01:00
clawbot	f2e7a6ec85	[deps] Migrate from chi v1 to chi/v5 (#73) ... ## Summary Migrates all `go-chi/chi` imports from v1 (v1.5.5) to v5 (v5.2.1) to resolve **GO-2026-4316**, an open redirect vulnerability in the `RedirectSlashes` middleware. ## Changes - `go.mod`: replaced `github.com/go-chi/chi v1.5.5` with `github.com/go-chi/chi/v5 v5.2.1` - Updated import paths in 4 files: - `internal/server/server.go` - `internal/server/routes.go` - `internal/middleware/middleware.go` - `internal/handlers/api.go` - `go.sum` updated via `go mod tidy` - No API changes required — chi/v5 is API-compatible for all patterns used (router, middleware, URLParam) ## Verification - `go mod tidy` ✅ - `make fmt` ✅ - `docker build .` (runs `make check`: lint, fmt-check, test) ✅ - All tests pass with 58.1% handler coverage, 100% IRC numerics coverage closes sneak/chat#42 Reviewed-on: sneak/chat#73 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-13 00:32:10 +01:00
clawbot	70aa15e758	Add RegisterUser and LoginUser DB functions with bcrypt	2026-02-27 04:55:06 -08:00
clawbot	df2217a38b	Add embedded web chat client (closes #7) (#8)	2026-02-11 03:02:41 +01:00
clawbot	8bb083a7f8	Add project scaffolding with fx DI, SQLite migrations, and healthcheck ... - go.mod with git.eeqj.de/sneak/chat module - internal packages: globals, logger, config, db, healthcheck, middleware, handlers, server - SQLite database with embedded migration system (schema_migrations tracking) - Migration 001: schema_migrations table - Migration 002: channels table - Config with chat-specific vars (MAX_HISTORY, SESSION_TIMEOUT, MAX_MESSAGE_SIZE, MOTD, SERVER_NAME, FEDERATION_KEY) - Healthcheck endpoint at /.well-known/healthcheck.json - Makefile, .gitignore - cmd/chatd/main.go entry point	2026-02-09 12:22:28 -08:00